Privacy Policy

1. Introduction

This Privacy Policy describes how FoundHex Inc., a Delaware C-Corporation ("FoundHex," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you use our Repaxio platform, website (repaxio.com), mobile applications, and related services (collectively, the "Services"). Repaxio is a product of FoundHex Inc.

Repaxio is an smart growth engine for local and multi-location businesses, providing reputation management, customer engagement via SMS and WhatsApp, loyalty programs, referral systems, and marketing services. By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy.

This policy applies to two categories of individuals:

• Clients ("Business Users"): Businesses and their authorized representatives who subscribe to Repaxio's platform.
• End Consumers: Customers of our Clients who interact with Repaxio-powered communications (review requests, SMS/WhatsApp messages, loyalty programs, feedback forms).

2. Information We Collect

2.1 Information from Business Users (Clients)

• Account registration details: name, email address, phone number, business name, business address, and billing information.
• Business profile information: industry type, number of locations, social media and review platform credentials (Google Business Profile, Facebook Page, Yelp, etc.).
• Payment and billing data processed through our third-party payment processors (Stripe for US, Razorpay for India).
• For Indian Business Users: Goods and Services Tax Identification Number (GSTIN), if provided, to determine applicable tax treatment under India's GST regime.
• WhatsApp Business Account information, phone numbers, and message templates submitted through our platform.
• Review platform access tokens and API credentials provided through OAuth authorization flows.
• Usage data: login times, feature usage, API calls, and platform interaction logs.

2.2 Information from End Consumers

• Contact information: first name, last name, phone number, and email address (collected via QR code feedback forms, review request campaigns, or loyalty sign-ups).
• Review and feedback data: star ratings, review text, and sentiment data.
• Communication preferences: opt-in/opt-out status for SMS, email, and WhatsApp messages.
• Loyalty and referral data: reward points, referral codes used, and redemption history.
• Device and browser information: IP address, browser type, operating system, and device identifiers.

2.3 Information Collected Automatically

• Log data: server logs, access times, pages viewed, referring URLs.
• Cookies and similar technologies: session cookies, analytics cookies, and functional cookies to maintain your preferences and improve our Services.
• Aggregate analytics: anonymized usage statistics for platform performance monitoring.

2.4 Information from Third-Party Platforms

When Business Users connect their accounts (Google Business Profile, Facebook, Yelp, WhatsApp Business API), we receive reviews, recommendations, page data, and messaging capabilities as authorized through OAuth or API connections. We access only the data you explicitly authorize and for the purposes described in this policy.

2.5 Information Received from Meta Platforms

When you connect your business accounts through Meta's platforms, we may receive the following data depending on the permissions you authorize:

• Facebook Pages: Page name, page ID, page access tokens, reviews and recommendations posted on your Facebook Page, page ratings, and page metadata (category, address, phone number) as authorized through Facebook Login and the Pages API.
• WhatsApp Business Platform: WhatsApp Business Account ID, registered phone number, display name, business profile information, message templates, message delivery and read receipts, and incoming messages from End Consumers who initiate conversations with your business.
• Facebook Login (if applicable): User ID, name, and email address when you authenticate using Facebook Login to access the Repaxio platform.

We do not receive or store Facebook user passwords. All Meta platform data is accessed exclusively through authorized APIs in compliance with Meta Platform Terms and Developer Policies.

2.6 Information Received from Google

When you connect your Google Business Profile through our OAuth-based authorization flow, we may receive the following data depending on the permissions you grant:

• Google Business Profile data: Business name, address, phone number, categories, hours of operation, business description, and profile metadata.
• Google Reviews: Customer reviews posted on your Google Business Profile, including reviewer display name, star rating, review text, review date, and your existing replies.
• Google Account identifiers: Your Google Account email address and account ID used to authenticate and link your Google Business Profile to Repaxio.

We access Google user data exclusively through Google's OAuth 2.0 authorization flow. We request only the minimum scopes necessary to provide review aggregation and response management functionality. We do not access Gmail, Google Drive, Google Contacts, or any Google data beyond what is described above. Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

2.7 Information Processed Through Twilio (US SMS/MMS)

Repaxio uses Twilio's programmable messaging platform to deliver SMS and MMS messages to United States recipients on behalf of Business Users. When SMS features are used, the following data is transmitted to and processed by Twilio:

• End Consumer data sent to Twilio: Recipient mobile phone number, message content (text and media), and sender phone number.
• Data received from Twilio: Message delivery status (queued, sent, delivered, failed, undelivered), message SID (unique identifier), error codes for failed deliveries, and inbound message content when End Consumers reply (including opt-out keywords such as STOP).
• Metadata: Timestamps, carrier information, number of message segments, and message direction (inbound/outbound).

Twilio acts as a sub-processor for message delivery. Twilio processes End Consumer phone numbers and message content solely for the purpose of transmitting messages and does not use this data for its own marketing purposes. Twilio's processing of data is governed by Twilio's Privacy Notice and Data Protection Addendum. Repaxio does not share End Consumer data with Twilio beyond what is necessary for message delivery and compliance.

Mobile Data Protection: We do not sell or share mobile phone numbers, SMS/MMS message content, or any other mobile-derived personal data with third parties, affiliates, or partners for marketing or promotional purposes. We only share mobile data with third-party service providers (such as Twilio) when it is strictly necessary to deliver our messaging service, and only under binding agreements that ensure confidentiality. Under no circumstances will mobile data be shared or sold for advertising or promotional use.

2.8 End Consumer SMS Communications

When you provide your phone number through a feedback form, QR code landing page, or other opt-in mechanism on our platform, you may receive text messages from the business whose form you completed. These messages are sent via the Repaxio platform on behalf of that business.

Information Collected: Phone number, consent status and timestamp, IP address, message delivery status.

How We Use This Information:

• To send messages on behalf of the business you interacted with
• To process opt-out requests (STOP keyword)
• To maintain compliance records as required by law

Data Sharing: We share your phone number with our messaging provider (Twilio) solely for message delivery. We do not sell or share your phone number or message data with third parties for marketing or promotional purposes. The business you provided your number to may access your contact information through our platform.

Opt-Out: Reply STOP to any message to opt out immediately. You may also contact us at support@repaxio.com.

Message Frequency: Message frequency varies by business. Message and data rates may apply. Consent is not a condition of any purchase.

3. How We Use Your Information

3.1 For Business Users

• To provide, maintain, and improve the Repaxio platform and its features.
• To aggregate and display reviews from connected platforms in a unified dashboard.
• To generate smart review response suggestions and sentiment analysis.
• To send review requests, promotional campaigns, and transactional messages via SMS, email, and WhatsApp on behalf of our Clients.
• To process payments and manage subscriptions.
• To determine applicable tax treatment, including GST place-of-supply determination for Indian customers using billing address, IP address, and payment method information as prescribed under Section 13(12) of the IGST Act, 2017.
• To provide customer support and respond to inquiries.
• To generate analytics reports, competitor analysis, and business insights.
• To administer loyalty programs, rewards, and referral tracking.

3.2 For End Consumers

• To deliver review requests, feedback forms, and promotional communications on behalf of our Clients.
• To manage loyalty rewards and referral benefits.
• To process and honor opt-in and opt-out preferences for messaging.
• To present public review options (e.g., Google, Yelp, Facebook) to all customers equally and to collect private feedback through our forms.

3.3 User Consent for Profile Building

In accordance with Meta Platform Terms, we obtain valid user consent before building or augmenting user profiles using data received from Meta platforms. Data received from Meta (such as Facebook Page reviews, WhatsApp message interactions, or Facebook Login information) is used solely for the purposes described in this policy and is not combined with data from other sources to build advertising profiles or shared with third parties for profiling purposes without your explicit consent.

3.4 AI and Automated Processing

Repaxio uses artificial intelligence to provide:

• Auto-generated review response suggestions
• Sentiment analysis on customer reviews
• smart insights and trend detection
• Smart routing of customer feedback

AI-generated content is always subject to human review before publication unless the Client enables automatic publishing. We do not use End Consumer personal data to train general-purpose AI models. AI processing is limited to the specific Client's account data for the purpose of delivering our Services.

4. SMS, WhatsApp, and Messaging Communications

Repaxio provides messaging capabilities through multiple channels depending on geography:

• United States: SMS and MMS messaging delivered through Twilio's programmable messaging platform, registered under US A2P 10DLC standards with The Campaign Registry (TCR).
• India and other markets: WhatsApp Business messaging delivered through Meta's WhatsApp Cloud API.
• All markets: Email communications delivered through Mailgun.

4.1 Consent and Opt-In

We are committed to compliance with the Telephone Consumer Protection Act (TCPA), Cellular Telecommunications Industry Association (CTIA) guidelines, WhatsApp Business Policy, and applicable state and international messaging laws.

• Express Written Consent: We require prior express written consent before sending any marketing or promotional messages via SMS or WhatsApp. Consent is obtained through digital opt-in forms, QR code landing pages, or other compliant mechanisms.
• Transactional Messages: Review requests, appointment reminders, order confirmations, and similar transactional messages are sent based on express consent or an existing business relationship.
• Double Opt-In: For recurring marketing messages, we implement a double opt-in confirmation process as recommended by CTIA guidelines.

4.2 Opt-Out and Revocation

• SMS: Reply STOP, QUIT, UNSUBSCRIBE, CANCEL, or END to any message to immediately opt out of future messaging.
• WhatsApp: Reply STOP to any message, or block the sender through WhatsApp's native controls.
• Email: Click the "Unsubscribe" link at the bottom of any email communication.

Reply HELP to any SMS or WhatsApp message to receive assistance and opt-out instructions. Opt-out requests are processed immediately or within 24 hours. We retain opt-out records for a minimum of four (4) years as required by the TCPA. Once opted out, no further messages will be sent unless the End Consumer provides new express consent.

4.3 Messaging Hours

Marketing messages are sent only between 8:00 AM and 9:00 PM in the recipient's local time zone, in accordance with TCPA requirements and applicable state laws. Transactional messages (e.g., appointment confirmations) may be sent outside these hours when operationally necessary.

4.4 Message Frequency and Data Rates

Message frequency varies based on the Client's campaign settings and the End Consumer's interaction with the business. Standard message and data rates from your wireless carrier may apply. Repaxio does not charge End Consumers for messages; however, carrier charges may apply.

4.5 Consent Records

We maintain detailed consent records including:

• Timestamp of consent
• Source and method of opt-in
• IP address at time of consent
• Specific campaign or communication consented to
• All opt-out requests and their timestamps

These records are retained for a minimum of four (4) years and are available for audit upon lawful request.

5. How We Share Your Information

We do not sell, rent, or trade personal information to third parties. We share information only in the following circumstances:

• Service Providers: We engage trusted third-party service providers to perform functions on our behalf, including cloud hosting (Microsoft Azure), payment processing (Stripe, Razorpay), email delivery (Mailgun), SMS delivery, WhatsApp Business API (Meta), authentication (Auth0), and analytics. These providers are contractually obligated to use personal data only to perform services for us and in compliance with this Privacy Policy.
• Business Users (Clients): End Consumer data collected on behalf of a Client (reviews, feedback, contact information) is shared with that Client through the Repaxio dashboard. Clients are responsible for their own use of such data in compliance with applicable laws.
• Review Platforms: When an End Consumer elects to leave a public review, they are redirected to the appropriate platform (e.g., Google, Facebook). We do not control data collected by those platforms; their respective privacy policies apply.
• Google: When Business Users connect their Google Business Profile, we access review data and business profile information through Google's APIs. When you authorize Repaxio to post review responses, we transmit your response text to Google on your behalf. We do not share End Consumer data with Google beyond what is inherent in the review response (which is publicly visible on Google). Our use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Twilio: For United States SMS and MMS messaging, End Consumer phone numbers and message content are transmitted to Twilio for delivery. Twilio acts as a sub-processor and processes this data solely for message transmission. Twilio also receives delivery status information and inbound reply messages (including opt-out keywords). We do not share End Consumer data with Twilio beyond what is strictly necessary for message delivery and regulatory compliance. Twilio's data handling is governed by their Data Protection Addendum.
• Legal Compliance: We may disclose information when required by law, subpoena, court order, or government request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a lawful government request.
• Tax Authorities: As a registered OIDAR service provider under India's GST regime, FoundHex files monthly returns (GSTR-5A) with the Indian GST authorities. These filings include aggregated, state-wise transaction data (taxable value and IGST amounts) for supplies to unregistered Indian recipients, and GSTIN-level details for supplies to GST-registered Indian businesses. Individual personal data beyond what is required for statutory tax filings is not shared with tax authorities unless required by law.
• Meta Platforms: When Business Users use Repaxio's WhatsApp Business integration, we transmit message content, media, and delivery instructions to Meta's WhatsApp Cloud API for message delivery. When Business Users connect their Facebook Pages, we access review data through Meta's APIs. We share only the data necessary to provide the Services as authorized by you. We do not share End Consumer personal data with Meta for advertising, profiling, or any purpose beyond delivering the Services you have requested. Our data practices are consistent with and do not supersede Meta Platform Terms.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify affected users via email or prominent notice on our platform.

6. Data Storage, Security, and Retention

6.1 Data Storage

All customer data is stored on Microsoft Azure servers located in the United States. We use industry-standard encryption both in transit (TLS 1.2+) and at rest (AES-256). Our infrastructure employs multi-tenant architecture with logical data separation ensuring that each Client's data is isolated from other Clients.

6.2 Security Measures

• Encryption of all data in transit and at rest.
• Authentication via Auth0 with support for multi-factor authentication (MFA).
• Role-based access controls (RBAC) for Client and team member accounts.
• Regular security audits, vulnerability assessments, and penetration testing.
• Automated backups with disaster recovery procedures.
• Access logging and monitoring for all administrative actions.
• VPN-secured access to administrative panels.

6.3 Data Retention

• Active account data: Retained for the duration of the Client's subscription, plus 90 days after account termination.
• Messaging consent records: Retained for a minimum of four (4) years per TCPA requirements.
• Transaction and billing records: Retained for seven (7) years per financial record-keeping requirements.
• GST compliance records (India): Invoice data, place-of-supply records, GSTIN details, and GSTR-5A filings retained for a minimum of seventy-two (72) months (6 years) from the due date of the annual return for the relevant year, as required under Section 36 of the CGST Act, 2017 and Rule 56 of the CGST Rules.
• Meta platform data: Deleted within thirty (30) days of account disconnection or deletion request, except where legal retention requirements apply.
• Google API data: Deleted within thirty (30) days of account disconnection or revocation of OAuth access, except for anonymized aggregate analytics.
• SMS/Twilio message logs: Message delivery logs and content are retained for the duration of the Client's subscription plus ninety (90) days. Consent records and opt-out logs are retained for a minimum of four (4) years as required by TCPA. Twilio may independently retain message metadata in accordance with their own data retention policies.
• Anonymized analytics data: May be retained indefinitely in aggregate, non-identifiable form.

7. Your Rights

7.1 All Users

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• The right to access, correct, or update your personal information.
• The right to request deletion of your personal data (subject to legal retention requirements).
• The right to opt out of marketing communications at any time.
• The right to withdraw consent for data processing.
• The right to data portability (receive your data in a structured, machine-readable format).

To exercise any of these rights, contact us at privacy@repaxio.com. We will respond to your request within 30 days or as required by applicable law.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, and disclose.
• The right to delete your personal information.
• The right to opt out of the sale or sharing of personal information (Repaxio does not sell personal information).
• The right to non-discrimination for exercising your privacy rights.

To submit a verifiable consumer request, email privacy@repaxio.com with the subject line "CCPA Request."

7.3 European Economic Area (GDPR)

If you are located in the European Economic Area, the legal bases for processing your personal data include consent, performance of a contract, legitimate interests, and compliance with legal obligations. You have additional rights including the right to restrict processing, the right to object to processing, and the right to lodge a complaint with a supervisory authority. For international data transfers from the EEA, we rely on Standard Contractual Clauses approved by the European Commission.

7.4 India (DPDP Act)

If you are located in India, your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 include:

• The right to access information about what personal data is being processed and the purpose thereof.
• The right to correction and erasure of personal data.
• The right to withdraw consent at any time through mechanisms provided in our platform.
• The right to nominate another individual to exercise your rights in case of death or incapacity.

We provide privacy notices in English and Hindi. Our consent mechanisms are designed to be specific, informed, and unconditional as required by the DPDP Act. Data breach notifications will be provided to affected individuals and the Data Protection Board of India within 72 hours of discovery.

8. Meta Platform Compliance

Repaxio integrates with Meta's platforms, including the WhatsApp Business Platform and Facebook Pages API, to provide messaging and review management services. Our use of Meta platform data complies with Meta Platform Terms, Developer Policies, and the Developer Data Use Policy.

8.1 Data We Receive from Meta

We receive data from Meta platforms only when you explicitly authorize access through OAuth, Embedded Signup, or other Meta-approved authentication flows. The specific data we receive is described in Section 2.5 of this policy. We process this data exclusively for the purposes of delivering the Repaxio Services you have subscribed to and as described in Section 3.

8.2 How We Use Meta Platform Data

• To display and aggregate Facebook Page reviews and recommendations in your Repaxio dashboard.
• To generate smart response suggestions for Facebook reviews.
• To send and receive WhatsApp messages on behalf of your business through the WhatsApp Cloud API.
• To manage WhatsApp message templates and monitor message delivery status.
• To authenticate your identity if you use Facebook Login to access Repaxio.

We do not use Meta platform data to build or augment user profiles for advertising, share it with third parties beyond what is necessary to provide the Services, or retain it beyond the periods described in Section 6.3.

8.3 WhatsApp Business Platform

Repaxio acts as a Tech Provider under Meta's WhatsApp Business Platform. When Business Users connect their WhatsApp Business Accounts through our Embedded Signup flow:

• We send messages only to End Consumers who have provided explicit opt-in consent to the Business User.
• Business-initiated messages use pre-approved Meta message templates only.
• We respect WhatsApp's 24-hour customer service window for non-template messages.
• We do not send spam, unsolicited messages, or messages that violate WhatsApp's policies.
• Each Business User's WhatsApp number is registered under their own WhatsApp Business Account, ensuring message authenticity and traceability.

8.4 Meta Data Deletion and Your Rights

You may disconnect Repaxio from your Meta accounts at any time through the following methods:

• From Repaxio: Navigate to Settings > Integrations in your Repaxio dashboard and click "Disconnect" next to Facebook or WhatsApp. This immediately revokes our access to your Meta platform data.
• From Facebook: Go to your Facebook Settings > Apps and Websites, locate Repaxio/FoundHex, and click "Remove." This triggers our data deletion process for all data received from Meta.
• Direct Request: Email privacy@repaxio.com with the subject line "Meta Data Deletion Request" to request deletion of all data received from Meta platforms.

Upon disconnection or deletion request, we will delete all data received from Meta platforms within thirty (30) days, except where retention is required by law (such as GST compliance records as described in Section 6.3). We will confirm deletion upon completion.

Data Deletion Callback: When you remove Repaxio from your Facebook Apps and Websites settings, Meta will notify us via a data deletion callback. We will process the deletion and provide a confirmation URL where you can check the status of your deletion request. If you need to verify the status of a deletion request, contact privacy@repaxio.com.

8.5 Meta Platform Terms Consistency

This Privacy Policy is intended to be consistent with Meta Platform Terms, Developer Policies, and the Developer Data Use Policy. In the event of any conflict between this Privacy Policy and Meta's terms with respect to data received from Meta platforms, Meta's terms shall prevail. This Privacy Policy does not supersede, modify, or reduce the protections provided by Meta's terms.

9. Google API Services Compliance

Repaxio integrates with Google Business Profile APIs to provide review aggregation and response management services. Our use of Google API Services complies with the Google API Services User Data Policy, including the Limited Use requirements.

9.1 How We Access Google Data

We access your Google Business Profile data exclusively through Google's OAuth 2.0 authorization flow. You must explicitly grant Repaxio permission to access your data by signing in with your Google Account and approving the requested scopes on Google's consent screen. We request only the minimum permissions (scopes) necessary to provide our Services.

9.2 How We Use Google Data

• To display your Google Business Profile reviews in your Repaxio dashboard alongside reviews from other platforms.
• To generate smart response suggestions for Google reviews.
• To post review responses to your Google Business Profile on your behalf, with your authorization.
• To provide sentiment analysis, rating trends, and competitive insights based on your review data.

We do not use Google user data for purposes unrelated to providing or improving the Repaxio Services you have requested. We do not use Google user data to serve advertisements. We do not transfer Google user data to third parties except as necessary to provide the Services (e.g., cloud hosting on Microsoft Azure), with your explicit consent, or as required by law.

9.3 Limited Use Disclosure

Repaxio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We limit our use of Google user data to providing and improving the Repaxio Services.
• We do not transfer Google user data to third parties except as necessary to provide the Services, with your consent, for security purposes, or to comply with applicable laws.
• We do not use Google user data to serve ads, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes, it is necessary to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymized.

9.4 Disconnecting Google and Data Deletion

You may disconnect your Google Business Profile from Repaxio at any time:

• From Repaxio: Navigate to Settings > Integrations and click "Disconnect" next to Google Business Profile. This immediately revokes our access to your Google data.
• From Google: Go to your Google Account > Third-party apps & services, locate Repaxio/FoundHex, and click "Remove Access." This revokes our OAuth tokens.
• Direct Request: Email privacy@repaxio.com with the subject line "Google Data Deletion Request."

Upon disconnection or deletion request, we will delete all data received from Google APIs within thirty (30) days, except where retention is required by law. Cached reviews that have already been processed for analytics may be retained in anonymized, aggregate form only.

10. Cookies and Tracking Technologies

Our platform uses the following types of cookies:

• Essential Cookies: Required for platform functionality, authentication, and security. These cannot be disabled.
• Analytics Cookies: Help us understand how users interact with our platform to improve performance and user experience.
• Functional Cookies: Remember your preferences such as language settings and dashboard customizations.

You can manage cookie preferences through your browser settings. Disabling certain cookies may limit your ability to use some features of our Services.

11. Children's Privacy

Repaxio's Services are designed for businesses and are not directed to individuals under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. If we discover that we have inadvertently collected data from a child, we will promptly delete it. If you believe a child has provided us with personal data, please contact us at privacy@repaxio.com.

12. Third-Party Links and Services

Our Services may contain links to third-party websites and services, including review platforms (Google, Facebook, Yelp), payment processors, and social media platforms. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the revised policy on our website with an updated "Effective Date."
• Sending an email notification to Business Users.
• Providing in-app notification of significant changes.

Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all requests within 30 days or as required by applicable law.